When police in the Brazilian state of Santa Catarina served search warrants on 10 September, they found four seed phrases, the word lists that unlock a crypto wallet. In a LinkedIn post, investigator Eduardo Graebin said the team imported the wallets and moved the funds to the force’s own account in real time, as Livecoins reported on Friday.
The haul came to R$8,781,864, about US$1.71 million or €1.53 million, in bitcoin, ether, TRX and USDT, according to the same account. The state’s Civil Police (PCSC) say it is the largest seizure of self-custody crypto by a Brazilian state police force. The coins now sit in an institutional PCSC account at the local exchange Foxbit, under state custody.
The operation, called ClickFix, was run by the PCSC’s cybercrime unit with the federal Ministry of Justice and Public Security. The ministry’s release of 11 Sep put the total seized or frozen at R$17.7 million, counting property and cars as well as crypto. It lists 17 search warrants and two arrest warrants, and says the courts blocked bank accounts of up to R$93 million, or about US$18 million at the rate implied by the police figures.
The ministry says investigators suspect the group of large online frauds and of breaking into public bodies’ systems. It says the group used “ClickFix”, a trick in which a fake error message on a website tells the visitor to paste a command into their own computer, handing control to the attacker. It also says the group sent fake summonses in the name of police agencies. The suspects are under investigation, and the ministry did not name them or list charges.
What “self-custody” changes for a police force
Coins on an exchange can be frozen by a court order served on the company. Coins in a self-custody wallet answer only to whoever holds the keys, so the police first need the seed phrase and then have to move the funds before anyone else can.
Graebin said Chainalysis’s Wallet Scan tool found about US$218,000 more, around R$1.12 million, assets that “might not have been identified had the analysis been limited to the information shown by conventional wallet software” (our translation of the Livecoins account). That sum is already inside the R$8.78 million total, Bitnotícias reported.
The figures do not fully line up. The ministry says the crypto came from three self-custody wallets, while the investigator’s post counts four seed phrases. We have not seen the two reconciled. Livecoins, Bitnotícias and SpaceMoney all describe a PCSC announcement on 7 Oct and quote the investigator’s post. We have not seen the post itself and found no PCSC page to check it against.
The sum is modest. The method is the point. It comes as the central bank’s 6 November cut-off pushes platforms toward licensing, and it shows enforcement reaching wallets that licensing rules for platforms do not cover.
Police have not said what will happen to the funds, or whether any of them belong to victims. The ministry’s description of ClickFix is also a reminder not to paste commands from a web page into a terminal. What a crypto custodian does explains the difference between holding keys yourself and having a firm hold them.
This article is for information only and is not investment advice.